Machete Analysis

IOB - Indicator of Behavior (47)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	42
es	4
de	2

Country

ca	6
us	6
ru	4
es	4
de	2

Actors

Machete	5
Donot	1
DPRK	1
Mirai	1

Activities

Interest

Timeline

Type

Not Defined	6
Content Management System	6
Operating System	4
Programming Language Software	4
Multimedia Player Software	4

Vendor

Oracle	6
Not Defined	6
Apple	4
Adobe	4
Google	2

Product

Oracle Java SE	4
Adobe Flash Player	4
Apple Mac OS X	2
phpBB	2
Google Chrome	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	CTI	EPSS	CVE
1	WordPress Access Restriction user-new.php access control	7.5	7.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.03	0.01232	CVE-2017-17091
2	Apple iOS/iPadOS Kernel information disclosure	3.3	3.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.01	0.05132	CVE-2020-27950
3	vBulletin visitormessage.php code injection	7.5	7.4	$0-$5k	$0-$5k	High	Unavailable	0.11	0.05164	CVE-2014-9463
4	phpBB startup.php cross site scripting	4.3	4.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.03	0.01408	CVE-2015-1431
5	Google Chrome Extensions use after free	7.5	7.4	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.03	0.17381	CVE-2022-4177
6	Google Chrome Forms use after free	7.5	7.4	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.02	0.17381	CVE-2022-4181
7	Bitrix Site Manager Vote Module Remote Code Execution	7.3	7.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02	0.01156	CVE-2022-27228
8	Joomla CMS sql injection	7.3	7.0	$5k-$25k	$0-$5k	High	Official Fix	0.04	0.93264	CVE-2015-7297
9	Oracle Java JRE/SE Sandbox privileges management	8.1	7.7	$25k-$100k	$0-$5k	Proof-of-Concept	Unavailable	0.00	0.00000
10	ZyXEL P660HN-T v1 ViewLog.asp command injection	7.3	6.4	$5k-$25k	$0-$5k	Proof-of-Concept	Workaround	0.00	0.00000
11	IBM WebSphere Application Server Admin Console resource consumption	6.5	6.5	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.01	0.01061	CVE-2019-4080
12	SunHater KCFinder upload.php cross site scripting	5.7	5.7	$0-$5k	$0-$5k	Not Defined	Not Defined	0.05	0.01055	CVE-2019-14315
13	Google Chrome UI buffer overflow	7.5	7.2	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.01	0.01055	CVE-2020-16010
14	MantisBT Attachment file_download.php information disclosure	4.8	4.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.01	0.01232	CVE-2015-5059
15	Microsoft Windows JET Database Engine memory corruption	6.8	6.5	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.09	0.39320	CVE-2017-8718
16	Backup / Restore Module Configuration Screen cross site scripting	3.6	3.6	$0-$5k	$0-$5k	Not Defined	Not Defined	0.03	0.00885	CVE-2019-19615
17	Apple Mac OS X Hypervisor memory corruption	8.8	7.9	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.67	0.01832	CVE-2015-7078
18	Microsoft Windows Remote Access Connection Manager Service information disclosure	3.3	3.3	$25k-$100k	$5k-$25k	Not Defined	Workaround	0.03	0.00000
19	ESMI PayPal Storefront products1h.php cross site scripting	4.3	4.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.02	0.06790	CVE-2005-0936
20	Userscape HelpSpot Reflected cross site scripting	5.2	4.9	$0-$5k	$0-$5k	Not Defined	Official Fix	0.05	0.00954	CVE-2017-16755

IOC - Indicator of Compromise (10)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Type	Confidence
1	31.207.44.72		Machete	verified	High
2	69.64.43.33	falcon207.startdedicated.com	Machete	verified	High
3	XXX.XX.XXX.XX	xxx-xx-xxx-xx.xxx.xxxx.xx	Xxxxxxx	verified	High
4	XXX.XX.XXX.XXX	xxxxx.xx-xxx-xx-xxx.xxx	Xxxxxxx	verified	High
5	XXX.XX.XXX.XX		Xxxxxxx	verified	High
6	XXX.XX.X.XXX	xxxxx.xx-xxx-xx-x.xxx	Xxxxxxx	verified	High
7	XXX.X.X.XXX	xxxxxx.xxx.x.x.xxx.xxxxxxx.xxxx-xxxxxx.xx	Xxxxxxx	verified	High
8	XXX.XXX.XXX.XX		Xxxxxxx	verified	High
9	XXX.XX.XX.XXX	xx-xxxxx-xxxx.xxxxxxxxxx.xxx	Xxxxxxx	verified	High
10	XXX.XXX.XXX.XXX	xxxx.xxxxxxxxxxxxx.xxxx	Xxxxxxx	verified	High

TTP - Tactics, Techniques, Procedures (8)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilities	Access Vector	Type	Confidence
1	T1055	CWE-74	Injection	predictive	High
2	T1059	CWE-94	Cross Site Scripting	predictive	High
3	TXXXX.XXX	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	High
4	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
5	TXXXX	CWE-XX	Xxxxxxx Xxxxxxxxx	predictive	High
6	TXXXX	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	High
7	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	High
8	TXXXX	CWE-XXX	Xxxxxxxxxxxxx	predictive	High

IOA - Indicator of Attack (19)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/admin/config.php?display=backup	predictive	High
2	File	/proc/self/cwd	predictive	High
3	File	file_download.php	predictive	High
4	File	xxxxxxxx/xxxxxxx.xxx	predictive	High
5	File	xxxxx.xxx	predictive	Medium
6	File	xxxxx.xxx?xx=xxxxxxxxx	predictive	High
7	File	xxxxxxxxxx.xxx	predictive	High
8	File	xxxxxx.xxx	predictive	Medium
9	File	xxxxxxx.xxx	predictive	Medium
10	File	xxxxxxxxxxxxxx.xxx	predictive	High
11	File	xx-xxxxx/xxxx-xxx.xxx	predictive	High
12	Library	xxxxxxxx-xx.xxx	predictive	High
13	Library	xxx xxxxxxxxxx	predictive	High
14	Argument	xxxx	predictive	Low
15	Argument	xxxxxxxxxxxxxxx	predictive	High
16	Argument	xxxx_xx	predictive	Low
17	Argument	xx	predictive	Low
18	Argument	xxxxxx_xxxx	predictive	Medium
19	Input Value	%xxxxxx+-x+x+xx.x.xx.xxx%xx%xx	predictive	High

References (4)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!